zeroc-ice 3.6.5 → 3.7.4

data/ext/ice/cpp/src/IceSSL/AcceptorI.cpp

@@ -1,33 +1,15 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/AcceptorI.h>
 #include <IceSSL/EndpointI.h>
 #include <IceSSL/Instance.h>
-
-#include <IceSSL/OpenSSLTransceiverI.h>
-#include <IceSSL/SecureTransportTransceiverI.h>
-#include <IceSSL/SChannelTransceiverI.h>
+#include <IceSSL/SSLEngine.h>
 
 #include <IceSSL/Util.h>
 
-#include <Ice/Communicator.h>
-#include <Ice/Exception.h>
 #include <Ice/LocalException.h>
-#include <Ice/LoggerUtil.h>
-#include <Ice/Properties.h>
-#include <Ice/StreamSocket.h>
-#include <IceUtil/StringUtil.h>
-
-#ifdef ICE_USE_IOCP
-#  include <Mswsock.h>
-#endif
 
 using namespace std;
 using namespace Ice;
@@ -38,90 +20,42 @@ IceUtil::Shared* IceSSL::upCast(AcceptorI* p) { return p; }
 IceInternal::NativeInfoPtr
 IceSSL::AcceptorI::getNativeInfo()
 {
-    return this;
+    return _delegate->getNativeInfo();
 }
 
-
-#ifdef ICE_USE_IOCP
+#if defined(ICE_USE_IOCP) || defined(ICE_OS_UWP)
 IceInternal::AsyncInfo*
-IceSSL::AcceptorI::getAsyncInfo(IceInternal::SocketOperation)
+IceSSL::AcceptorI::getAsyncInfo(IceInternal::SocketOperation status)
 {
-    return &_info;
+    return _delegate->getNativeInfo()->getAsyncInfo(status);
 }
 #endif
 
 void
 IceSSL::AcceptorI::close()
 {
-    if(_fd != INVALID_SOCKET)
-    {
-        IceInternal::closeSocketNoThrow(_fd);
-        _fd = INVALID_SOCKET;
-    }
+    _delegate->close();
 }
 
 IceInternal::EndpointIPtr
 IceSSL::AcceptorI::listen()
 {
-    try
-    {
-        const_cast<IceInternal::Address&>(_addr) = IceInternal::doBind(_fd, _addr);
-        IceInternal::doListen(_fd, _backlog);
-    }
-    catch(...)
-    {
-        _fd = INVALID_SOCKET;
-        throw;
-    }
-    _endpoint = _endpoint->endpoint(this);
+    _endpoint = _endpoint->endpoint(_delegate->listen());
     return _endpoint;
 }
 
-#ifdef ICE_USE_IOCP
+#if defined(ICE_USE_IOCP) || defined(ICE_OS_UWP)
 void
 IceSSL::AcceptorI::startAccept()
 {
-    LPFN_ACCEPTEX AcceptEx = NULL; // a pointer to the 'AcceptEx()' function
-    GUID GuidAcceptEx = WSAID_ACCEPTEX; // The Guid
-    DWORD dwBytes;
-    if(WSAIoctl(_fd,
-                SIO_GET_EXTENSION_FUNCTION_POINTER,
-                &GuidAcceptEx,
-                sizeof(GuidAcceptEx),
-                &AcceptEx,
-                sizeof(AcceptEx),
-                &dwBytes,
-                NULL,
-                NULL) == SOCKET_ERROR)
-    {
-        SocketException ex(__FILE__, __LINE__);
-        ex.error = IceInternal::getSocketErrno();
-        throw ex;
-    }
+    _delegate->startAccept();
 
-    assert(_acceptFd == INVALID_SOCKET);
-    _acceptFd = IceInternal::createSocket(false, _addr);
-    const int sz = static_cast<int>(_acceptBuf.size() / 2);
-    if(!AcceptEx(_fd, _acceptFd, &_acceptBuf[0], 0, sz, sz, &_info.count, &_info))
-    {
-        if(!IceInternal::wouldBlock())
-        {
-            SocketException ex(__FILE__, __LINE__);
-            ex.error = IceInternal::getSocketErrno();
-            throw ex;
-        }
-    }
 }
 
 void
 IceSSL::AcceptorI::finishAccept()
 {
-    if(static_cast<int>(_info.count) == SOCKET_ERROR || _fd == INVALID_SOCKET)
-    {
-        IceInternal::closeSocketNoThrow(_acceptFd);
-        _acceptFd = INVALID_SOCKET;
-        _acceptError = _info.error;
-    }
+    _delegate->finishAccept();
 }
 #endif
 
@@ -133,126 +67,39 @@ IceSSL::AcceptorI::accept()
     //
     if(!_instance->initialized())
     {
-        PluginInitializationException ex(__FILE__, __LINE__);
-        ex.reason = "IceSSL: plug-in is not initialized";
-        throw ex;
-    }
-
-#ifndef ICE_USE_IOCP
-    SOCKET fd = IceInternal::doAccept(_fd);
-#else
-    if(_acceptFd == INVALID_SOCKET)
-    {
-        SocketException ex(__FILE__, __LINE__);
-        ex.error = _acceptError;
-        throw ex;
-    }
-
-    if(setsockopt(_acceptFd, SOL_SOCKET, SO_UPDATE_ACCEPT_CONTEXT, (char*)&_acceptFd, sizeof(_acceptFd)) ==
-       SOCKET_ERROR)
-    {
-        IceInternal::closeSocketNoThrow(_acceptFd);
-        _acceptFd = INVALID_SOCKET;
-        SocketException ex(__FILE__, __LINE__);
-        ex.error = IceInternal::getSocketErrno();
-        throw ex;
+        throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: plug-in is not initialized");
     }
 
-    SOCKET fd = _acceptFd;
-    _acceptFd = INVALID_SOCKET;
-#endif
-
-    //
-    // SSL handshaking is performed in TransceiverI::initialize, since
-    // accept must not block.
-    //
-    return new TransceiverI(_instance, new IceInternal::StreamSocket(_instance, fd), _adapterName, true);
+    return _instance->engine()->createTransceiver(_instance, _delegate->accept(), _adapterName, true);
 }
 
 string
 IceSSL::AcceptorI::protocol() const
 {
-    return _instance->protocol();
+    return _delegate->protocol();
 }
 
 string
 IceSSL::AcceptorI::toString() const
 {
-    return IceInternal::addrToString(_addr);
+    return _delegate->toString();
 }
 
 string
 IceSSL::AcceptorI::toDetailedString() const
 {
-    ostringstream os;
-    os << "local address = " << toString();
-    vector<string> intfs = getHostsForEndpointExpand(inetAddrToString(_addr), _instance->protocolSupport(), true);
-    if(!intfs.empty())
-    {
-        os << "\nlocal interfaces = ";
-        os << IceUtilInternal::joinString(intfs, ", ");
-    }
-    return os.str();
-}
-
-int
-IceSSL::AcceptorI::effectivePort() const
-{
-    if(_addr.saStorage.ss_family == AF_INET)
-    {
-        return ntohs(_addr.saIn.sin_port);
-    }
-    else
-    {
-        return ntohs(_addr.saIn6.sin6_port);
-    }
+    return _delegate->toDetailedString();
 }
 
-IceSSL::AcceptorI::AcceptorI(const EndpointIPtr& endpoint, const InstancePtr& instance, const string& adapterName,
-                             const string& host, int port) :
+IceSSL::AcceptorI::AcceptorI(const EndpointIPtr& endpoint, const InstancePtr& instance,
+                             const IceInternal::AcceptorPtr& del, const string& adapterName) :
     _endpoint(endpoint),
     _instance(instance),
-    _adapterName(adapterName),
-    _addr(IceInternal::getAddressForServer(host, port, instance->protocolSupport(), instance->preferIPv6()))
-#ifdef ICE_USE_IOCP
-    , _acceptFd(INVALID_SOCKET),
-    _info(IceInternal::SocketOperationRead)
-#endif
+    _delegate(del),
+    _adapterName(adapterName)
 {
-#ifdef SOMAXCONN
-    _backlog = instance->properties()->getPropertyAsIntWithDefault("Ice.TCP.Backlog", SOMAXCONN);
-#else
-    _backlog = instance->properties()->getPropertyAsIntWithDefault("Ice.TCP.Backlog", 511);
-#endif
-
-    IceInternal::ProtocolSupport protocol = instance->protocolSupport();
-    _fd = IceInternal::createServerSocket(false, _addr, protocol);
-#ifdef ICE_USE_IOCP
-    _acceptBuf.resize((sizeof(sockaddr_storage) + 16) * 2);
-#endif
-    IceInternal::setBlock(_fd, false);
-    IceInternal::setTcpBufSize(_fd, _instance);
-#ifndef _WIN32
-    //
-    // Enable SO_REUSEADDR on Unix platforms to allow re-using the
-    // socket even if it's in the TIME_WAIT state. On Windows,
-    // this doesn't appear to be necessary and enabling
-    // SO_REUSEADDR would actually not be a good thing since it
-    // allows a second process to bind to an address even it's
-    // already bound by another process.
-    //
-    // TODO: using SO_EXCLUSIVEADDRUSE on Windows would probably
-    // be better but it's only supported by recent Windows
-    // versions (XP SP2, Windows Server 2003).
-    //
-    IceInternal::setReuseAddress(_fd, true);
-#endif
 }
 
 IceSSL::AcceptorI::~AcceptorI()
 {
-    assert(_fd == INVALID_SOCKET);
-#ifdef ICE_USE_IOCP
-    assert(_acceptFd == INVALID_SOCKET);
-#endif
 }

data/ext/ice/cpp/src/IceSSL/AcceptorI.h

@@ -1,14 +1,9 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
-#ifndef ICE_SSL_ACCEPTOR_I_H
-#define ICE_SSL_ACCEPTOR_I_H
+#ifndef ICESSL_ACCEPTOR_I_H
+#define ICESSL_ACCEPTOR_I_H
 
 #include <Ice/TransceiverF.h>
 #include <Ice/Acceptor.h>
@@ -25,13 +20,13 @@ class AcceptorI : public IceInternal::Acceptor, public IceInternal::NativeInfo
 public:
 
     virtual IceInternal::NativeInfoPtr getNativeInfo();
-#ifdef ICE_USE_IOCP
+#if defined(ICE_USE_IOCP) || defined(ICE_OS_UWP)
     virtual IceInternal::AsyncInfo* getAsyncInfo(IceInternal::SocketOperation);
 #endif
 
     virtual void close();
     virtual IceInternal::EndpointIPtr listen();
-#ifdef ICE_USE_IOCP
+#if defined(ICE_USE_IOCP) || defined(ICE_OS_UWP)
     virtual void startAccept();
     virtual void finishAccept();
 #endif
@@ -40,27 +35,18 @@ public:
     virtual std::string toString() const;
     virtual std::string toDetailedString() const;
 
-    int effectivePort() const;
-
 private:
 
-    AcceptorI(const EndpointIPtr&, const InstancePtr&, const std::string&, const std::string&, int);
+    AcceptorI(const EndpointIPtr&, const InstancePtr&, const IceInternal::AcceptorPtr&, const std::string&);
     virtual ~AcceptorI();
     friend class EndpointI;
 
     EndpointIPtr _endpoint;
     const InstancePtr _instance;
+    const IceInternal::AcceptorPtr _delegate;
     const std::string _adapterName;
-    const IceInternal::Address _addr;
-    int _backlog;
-#ifdef ICE_USE_IOCP
-    SOCKET _acceptFd;
-    int _acceptError;
-    std::vector<char> _acceptBuf;
-    IceInternal::AsyncInfo _info;
-#endif
 };
 
 }
 
-#endif
+#endif // IceSSL namespace end

data/ext/ice/cpp/src/IceSSL/CertificateI.cpp

@@ -0,0 +1,279 @@
+//
+// Copyright (c) ZeroC, Inc. All rights reserved.
+//
+
+#include <IceUtil/DisableWarnings.h>
+#include <IceUtil/Mutex.h>
+#include <IceUtil/MutexPtrLock.h>
+#include <IceUtil/StringUtil.h>
+#include <IceSSL/Plugin.h>
+#include <IceSSL/Util.h>
+#include <IceSSL/RFC2253.h>
+#include <IceSSL/CertificateI.h>
+#include <Ice/Object.h>
+#include <Ice/Base64.h>
+#include <Ice/LocalException.h>
+#include <Ice/StringConverter.h>
+#include <IceUtil/Time.h>
+
+using namespace std;
+using namespace Ice;
+using namespace IceInternal;
+using namespace IceSSL;
+
+//
+// Map a certificate OID to its alias
+//
+const CertificateOID IceSSL::certificateOIDS[] =
+{
+    {"2.5.4.3", "CN"},
+    {"2.5.4.4", "SN"},
+    {"2.5.4.5", "DeviceSerialNumber"},
+    {"2.5.4.6", "C"},
+    {"2.5.4.7", "L"},
+    {"2.5.4.8", "ST"},
+    {"2.5.4.9", "STREET"},
+    {"2.5.4.10", "O"},
+    {"2.5.4.11", "OU"},
+    {"2.5.4.12", "T"},
+    {"2.5.4.42", "G"},
+    {"2.5.4.43", "I"},
+    {"1.2.840.113549.1.9.8", "unstructuredAddress"},
+    {"1.2.840.113549.1.9.2", "unstructuredName"},
+    {"1.2.840.113549.1.9.1", "emailAddress"},
+    {"0.9.2342.19200300.100.1.25", "DC"}
+};
+const int IceSSL::certificateOIDSSize = sizeof(IceSSL::certificateOIDS) / sizeof(CertificateOID);
+
+CertificateReadException::CertificateReadException(const char* file, int line, const string& r) :
+    IceUtil::ExceptionHelper<CertificateReadException>(file, line),
+    reason(r)
+{
+}
+
+#ifndef ICE_CPP11_COMPILER
+CertificateReadException::~CertificateReadException() throw()
+{
+}
+#endif
+
+string
+CertificateReadException::ice_id() const
+{
+    return "::IceSSL::CertificateReadException";
+}
+
+#ifndef ICE_CPP11_MAPPING
+CertificateReadException*
+CertificateReadException::ice_clone() const
+{
+    return new CertificateReadException(*this);
+}
+#endif
+
+CertificateEncodingException::CertificateEncodingException(const char* file, int line, const string& r) :
+    IceUtil::ExceptionHelper<CertificateEncodingException>(file, line),
+    reason(r)
+{
+}
+
+#ifndef ICE_CPP11_COMPILER
+CertificateEncodingException::~CertificateEncodingException() throw()
+{
+}
+#endif
+
+string
+CertificateEncodingException::ice_id() const
+{
+    return "::IceSSL::CertificateEncodingException";
+}
+
+#ifndef ICE_CPP11_MAPPING
+CertificateEncodingException*
+CertificateEncodingException::ice_clone() const
+{
+    return new CertificateEncodingException(*this);
+}
+#endif
+
+ParseException::ParseException(const char* file, int line, const string& r) :
+    IceUtil::ExceptionHelper<ParseException>(file, line),
+    reason(r)
+{
+}
+
+#ifndef ICE_CPP11_COMPILER
+ParseException::~ParseException() throw()
+{
+}
+#endif
+
+string
+ParseException::ice_id() const
+{
+    return "::IceSSL::ParseException";
+}
+
+#ifndef ICE_CPP11_MAPPING
+ParseException*
+ParseException::ice_clone() const
+{
+    return new ParseException(*this);
+}
+#endif
+
+DistinguishedName::DistinguishedName(const string& dn) : _rdns(RFC2253::parseStrict(dn))
+{
+    unescape();
+}
+
+DistinguishedName::DistinguishedName(const list<pair<string, string> >& rdns) : _rdns(rdns)
+{
+    unescape();
+}
+
+namespace IceSSL
+{
+
+bool
+operator==(const DistinguishedName& lhs, const DistinguishedName& rhs)
+{
+    return lhs._unescaped == rhs._unescaped;
+}
+
+bool
+operator<(const DistinguishedName& lhs, const DistinguishedName& rhs)
+{
+    return lhs._unescaped < rhs._unescaped;
+}
+
+}
+
+bool
+DistinguishedName::match(const DistinguishedName& other) const
+{
+    for(list< pair<string, string> >::const_iterator p = other._unescaped.begin(); p != other._unescaped.end(); ++p)
+    {
+        bool found = false;
+        for(list< pair<string, string> >::const_iterator q = _unescaped.begin(); q != _unescaped.end(); ++q)
+        {
+            if(p->first == q->first)
+            {
+                found = true;
+                if(p->second != q->second)
+                {
+                    return false;
+                }
+            }
+        }
+        if(!found)
+        {
+            return false;
+        }
+    }
+    return true;
+}
+
+bool
+DistinguishedName::match(const string& other) const
+{
+    return match(DistinguishedName(other));
+}
+
+//
+// This always produces the same output as the input DN -- the type of
+// escaping is not changed.
+//
+DistinguishedName::operator string() const
+{
+    ostringstream os;
+    bool first = true;
+    for(list< pair<string, string> >::const_iterator p = _rdns.begin(); p != _rdns.end(); ++p)
+    {
+        if(!first)
+        {
+            os << ",";
+        }
+        first = false;
+        os << p->first << "=" << p->second;
+    }
+    return os.str();
+}
+
+void
+DistinguishedName::unescape()
+{
+    for(list< pair<string, string> >::const_iterator q = _rdns.begin(); q != _rdns.end(); ++q)
+    {
+        pair<string, string> rdn = *q;
+        rdn.second = RFC2253::unescape(rdn.second);
+        _unescaped.push_back(rdn);
+    }
+}
+
+bool
+CertificateI::operator!=(const IceSSL::Certificate& other) const
+{
+    return !operator==(other);
+}
+
+vector<X509ExtensionPtr>
+CertificateI::getX509Extensions() const
+{
+    loadX509Extensions(); // Lazzy initialize the extensions
+    return _extensions;
+}
+
+X509ExtensionPtr
+CertificateI::getX509Extension(const string& oid) const
+{
+    loadX509Extensions(); // Lazzy initialize the extensions
+    X509ExtensionPtr ext;
+    for(vector<X509ExtensionPtr>::const_iterator i = _extensions.begin(); i != _extensions.end(); ++i)
+    {
+        if((*i)->getOID() == oid)
+        {
+            ext = *i;
+            break;
+        }
+    }
+    return ext;
+}
+
+void
+CertificateI::loadX509Extensions() const
+{
+    throw FeatureNotSupportedException(__FILE__, __LINE__);
+}
+
+bool
+CertificateI::checkValidity() const
+{
+#  ifdef ICE_CPP11_MAPPING
+    auto now = chrono::system_clock::now();
+#  else
+    IceUtil::Time now = IceUtil::Time::now();
+#  endif
+    return now > getNotBefore() && now <= getNotAfter();
+}
+
+bool
+#  ifdef ICE_CPP11_MAPPING
+CertificateI::checkValidity(const chrono::system_clock::time_point& now) const
+#  else
+CertificateI::checkValidity(const IceUtil::Time& now) const
+#  endif
+{
+    return now > getNotBefore() && now <= getNotAfter();
+}
+
+string
+CertificateI::toString() const
+{
+    ostringstream os;
+    os << "serial: " << getSerialNumber() << "\n";
+    os << "issuer: " << string(getIssuerDN()) << "\n";
+    os << "subject: " << string(getSubjectDN()) << "\n";
+    return os.str();
+}